# HG changeset patch # User reimar # Date 1246809711 0 # Node ID 8332746a9db9be0bd5f89deee63ef97c8db83eb3 # Parent c7c1c6b35a736fc6bbb603b61e9107399e08a93a Add a check to vp6_parse_coeff_huffman to ensure it does not overread the input buffer. diff -r c7c1c6b35a73 -r 8332746a9db9 vp6.c --- a/vp6.c Sun Jul 05 15:23:42 2009 +0000 +++ b/vp6.c Sun Jul 05 16:01:51 2009 +0000 @@ -372,6 +372,8 @@ if (coeff_idx) break; } else { + if (get_bits_count(&s->gb) >= s->gb.size_in_bits) + return; coeff = get_vlc2(&s->gb, vlc_coeff->table, 9, 3); if (coeff == 0) { if (coeff_idx) {